514a2e1ebfc231e3bd8275f2f51023e418deeb2aeda808dd35e8317424370a30

General

Target

invoice.exe
Size

605KB
MD5

9d1c09ccad422151959b7f47a88e70bf
SHA1

5766569901c1a6c583f3dbde63b6971ecbe7b129
SHA256

514a2e1ebfc231e3bd8275f2f51023e418deeb2aeda808dd35e8317424370a30
SHA512

bd5e2693d8aa553225479010a1f78c1643478ca8a83139faefa68aae353dd8e92d084436d0a7c259f00d1564d8a0d302a808cbd6c43ed0cb6f669df1e49cbbd7

Score

8^/10

spyware

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

invoice.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts invoice.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

invoice.exe

description pid process target process

PID 1204 set thread context of 436 1204 invoice.exe invoice.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1500 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

invoice.exeinvoice.exe

pid process

1204 invoice.exe
1204 invoice.exe
436 invoice.exe
436 invoice.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

invoice.exeinvoice.exe

description pid process

Token: SeDebugPrivilege 1204 invoice.exe
Token: SeDebugPrivilege 436 invoice.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	invoice.exe

description	pid	process	target process
PID 1204 set thread context of 436	1204	invoice.exe	invoice.exe

pid	process
1500	schtasks.exe

pid	process
1204	invoice.exe
1204	invoice.exe
436	invoice.exe
436	invoice.exe

description	pid	process
Token: SeDebugPrivilege	1204	invoice.exe
Token: SeDebugPrivilege	436	invoice.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

invoice.exe

description	pid	process	target process
PID 1204 wrote to memory of 1500	1204	invoice.exe	schtasks.exe
PID 1204 wrote to memory of 1500	1204	invoice.exe	schtasks.exe
PID 1204 wrote to memory of 1500	1204	invoice.exe	schtasks.exe
PID 1204 wrote to memory of 1500	1204	invoice.exe	schtasks.exe
PID 1204 wrote to memory of 756	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 756	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 756	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 756	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe
PID 1204 wrote to memory of 436	1204	invoice.exe	invoice.exe

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"C:\Users\Admin\AppData\Local\Temp\invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mEIuqNly" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB1E.tmp"
2⤵
- Creates scheduled task(s)
PID:1500

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"{path}"
2⤵
PID:756

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAB1E.tmp

MD5
f56a18e40273db3e2add8a83d5b0d0bb

SHA1
3cf2d23b5487f1fd37f07da0320e9475f3704453

SHA256
2f048c6bef43a730cae529d94e81eb276d3e8f38107a3087d9e87fc69ed2cacd

SHA512
42f579565f75792df455827c6eca64b3d4c73b27b67643d727c90cc4819d4c3627f234075cd1ee8b28095e95f99d7cbce60106fd1328fbce63717212ca6e0704

Download Submit
memory/436-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/436-10-0x0000000000436DAE-mapping.dmp

Download
memory/436-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/436-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/436-13-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1204-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1204-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1204-5-0x00000000009D0000-0x00000000009DE000-memory.dmp

Filesize
56KB

Download
memory/1204-6-0x0000000005130000-0x00000000051B7000-memory.dmp

Filesize
540KB

Download
memory/1500-7-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads